On Tue, 28 Jul 2009, Ivan Kalik wrote: Thankyou for the reply and suggestion. I've been interstate and just back now to try it.

Create two mschap module instances, mschap_co1 with first ntlm_auth line and mschap_co2 with second one.

ok.

Then create redundancy inside Auth-Type MS-CHAP (default server for mschap requests, inner-tunnel for peap):

Auth-Type MS-CHAP { if(Realm == "company1.local") { mschap_co1 } elsif(Realm == "company2.local") { mschap_co2 } else { mschap (or reject if you don't want to try users file, sql, ldap or other accounts) } }

When I do this, stop radiusd and re-run with -X, I get: reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf /usr/local/etc/raddb/radiusd.conf[1948]: Line is not in 'attribute = value' format Errors reading radiusd.conf I then commented out most to check for stupid operator errors: # new MSCHAP authentication. # auths differently depending on the realm # If none of the defined realms, use standard Auth-Type MS-CHAP { # if(Realm == "aae.local") { mschap_co1 # } # elseif(Realm == "lla.local") { mschap_co2 # } # else { # mschap # } } This at least got further... but not much. Here's the -X output: # /usr/local/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: bind_address = 127.0.0.1 IP address [127.0.0.1] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) radiusd.conf[723] Failed to link to module 'rlm_mschap_co1': Shared object "rlm_mschap_co1.so" not found, required by "radiusd" radiusd.conf[1949] Unknown module "mschap_co1". radiusd.conf[1949] Failed to parse "mschap_co1" entry. bash-2.05b# I'm simply not familiar enough with FreeRadius to know where to go with this - I learned enough to set it up many years ago on my own systems, it's been rock-solid ever since and I guess I've just forgotten it all. This particular configuration was done by someone else and is quite different to my own. Any (further) help appreciated.